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Note that ( mod q) represents an equation in which the residue is determined by 
dividing by q. Given S, q and g in equation [1], P is easily calculated. If P, q, 
and g are known, however, determining S becomes more and more difficult as q 
increases. S is called a discrete logarithm of P wherein q is its modulus and g 
is its base. Determining S is well known as the discrete logarithm problem. 

DEPR: 

In any of the embodiments 1 through 4, g is a primitive root of the residue - class 
field with q as modulus . The primitive root g is a positive integer equal to or 
less than (q-1) , with q assumed to be a prime number, and the primitive root g to 
(q-l)st power is 1 in connection with mod q (g. sup. q-1 -1 mod q) . Alternatively, 
an integer g' may replace g, by using a divisor q' of (q-1); thus, g' to q' power 
is 1 in connection with mod q (g.sup.q* =1 mod q, q' : the divisor of q-1) . This 
is fully discussed in the paper authored by C. P. Schnorr, entitled "Efficient 
Identification and Signatures For Smart Cards" in Proc . CRYPT089 . Although the 
use of g' provides less security against an exhaustive attach to cope with the 
discrete logarithm problem, compared with the case where the primitive root g is 
used, the workload involved in calculations on the users is alleviated. For 
example, calculation process amount of the public key generation step in the 
first embodiment is approx . ( 1 . 5 . t imes . log ,sub.2 q ' +0 . 25 . times . log . sub . 2 Hi) 
times of residue of the multiplication calculation process per log . sub . 2 q bit 
width on average. To assure sufficient security, in this case, a value of 140 
bits or larger may be used for q* . Substituting 140 for log . sub . 2 q', and 128 
for log .sub. 2 Hi, results in 242 as the number of iteration in calculation. 
Therefore, it is almost three times as fast as the first embodiment. 
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- Described is a method of converting a 'Logical Block Address' to cylinder track 
and sector values on a microprocessor without a divide instruction. After 
breaking the dividend into bytes, look-up tables are used to find quotients and 
remainders . Carries are used while computing the remainder to adjust the 
quotient. Speed is gained at the expense of table space. - Microprocessors which 
do not have a built-in divide instruction need software algorithms to perform 
division. These are usually implemented as a loop, containing subtraction and 
shifting operations, executed as many times as there are bits in the dividend 
and, in consequence, are slow. When the divisor is a known constant and if 
execution time is critical, a faster algorithm is required. - An example is when 
dividing a logical block address (LBA) received in a SCSI command by the number 
of sectors per cylinder, to get the cylinder address. The remainder of the 
division is then further divided by the number of heads, to get the track and 
sector numbers. - The advantages of this algorithm are fast execution with both 
quotient and remainder generated. When dividing an N-byte number (the dividend ) 
by a given constant divisor (K) , the dividend is first sp lit, up i nto N par ts, at 
byte boundaries. - Example: (N=3) 1 123456 ! x = '120000'x + '3400'x + 'J56 ' x 
i2_= ' 12 ' x il='34'x i0='56'x Each index 1 is then used as an index into a table of 
256 entries which gives both the quotient and remainder when that part of the 
dividend is divided by divisor K. - Thus, i2 in the example is used as an index 
into Table2 which contains entries: i2 quotient remainder 0 ' 00000 'x DIV K 
' 00000 'x MOD k 1 '10000'x DIV K '10000'x MOD k 2 '20000'x DIV K '20000'x MOD k : 
: : : : : 255 'FFOOOO'x DIV K 'FFOOOO'x MOD k Similar tables Tablel and TableO 
are used with il and iO. - This results in N quotient val ues and N remainder 
values being extracted from the tables; quotient values are summed to give a 
total Q. The remainder values are then also added, giving R , with a test after 
eacTT^a^d i t i on for whether the sum exceeds the divisor K. T~f it does, K is 
subtracted and Q is incremented by 1. There are N-l addition operations to 
generate R. The result is the quotient Q and remainder R. - A few short-cuts may 
be applied to reduce the amount of storage occupied byHfRe tables. If the divisor 
exceeds '100'x, then the remainders in TableO will be equal to the index iO, and 
so the ' remainder 1 half of TableO is unnecessary. If the divisor exceeds 
'10000'x, then this applies to Tablel also, etc. Should the range of dividend 
values be restricted, then not all of the most - significant table is required. For 
example, with N=3, if the dividend never exceeds ' 1FFFFF ' x, then Table2 need only 
have the first '20'x entries. * 
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DEPR: 

So far, the decoding algorithm has been implemented by electronic digital 
hardware based on serial data processing (U.S. Pat. No. 5,402,429; Maniatopoulos 
A. et al . , "Single -bit error-correction circuit for ATM interfaces", Electronics 
Letters, 31, No. 8, 617-618, 1995; Maniatopoulos A. et al . , "Implementation 
issues of the ATM cell delineation mechanism", Electronics Letters, 32, No. 11, 
963-965, 1996) . The decoder is usually a simple dedicated DSP circuit employing a 
serial shift register as fundamental device, essentially able to perform a binary 
polynomial division . The scheme of such circuit is well known (FIG. 13) . To 
divide two polynomials the shift register must have a number of flip-flop cells 
equal to the degree of the divisor, and a pattern of logic "feedback loops " 
configured according to the coefficients of the divisor . Each feedback loop feeds 
bits from the last stage of the shift register to a summing node ( modulo -2 sum, 
or XOR) . Into the summing nodes the back fed bits are added to the output of an 
intermediate flip-flop. Before starting the operation, all flip-flops must be 
cleared. The dividend bits flow sequentially into the first flip-flop starting 
from the most significant, and at each clock pulse they are shifted one step 
towards the last cell. When the last dividend bit has entered the device the 
division remainder bits are kept stored into the memory cells of the shift 
register. They can be read from the output by shifting again, after all the 
feedback loops have been opened. 
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The shift -dividing have following steps. At first an inititial value is set for a 
counting value. Secondly, the high-byte remainder is leftwardly shifted one bit 
to obtain a number. Then, the divisor is substracted from the number to update 
the high-byte remainder and the counting value is added to the low -byte quotient 
to update the high-byte quotient when the number is not less than the divisor . 
The counter is circularly and rightwardly shifting one bit. Finally, the step 
that the high-byte remainder is leftwardly shifted one bit is repeated until the 
counting value returns to the initital value. 
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